Choosing the Right Key Responsibility Model

When organizations move sensitive workloads to the cloud, encryption is usually the easy part. The harder question is: who actually controls the keys? Unfortunately, terms like BYOK, HYOK, and CMK do not have an agreed-upon meaning throughout the industry.

Our new Key Responsibility Models infographic tackles this problem head-on. It maps how providers and customers share responsibilities across key management approaches.

In this blog, we draw on the information in the infographic to highlight:

• The difference between the various key responsibility models
• How these models affect your risk, not just your marketing diagrams
• What to look at when choosing a model for high-value or regulated data

 

A Quick Tour of the Key Models

You can group cloud key management into several high-level models:

• Provider-Managed Keys (PMKs): The CSP generates, stores, uses, rotates, and backs up the keys. Customers typically never see the keys. Customers enable encryption on a service (for example, a cloud-native database encrypting data at rest).
• Customer-Managed Keys (CMKs): The customer directs the key lifecycle (generation, usage, rotation, and sometimes residency requirements). However, the CSP typically stores and uses the keys within their KMS/HSM.
• Bring Your Own Key (BYOK): A variant of CMK where the customer generates key material externally, such as in their own KMS or HSM. They then securely import it into the CSP’s environment.
• Hold Your Own Key (HYOK): The customer maintains control of keys in their own KMS. The customer-managed KMS handles encryption key operations and requests. Data may be in the CSP, but keys stay under the customer’s control.
• Hybrid Models: Combinations (like exportable CMKs or Control Your Own Key) that blend aspects of the above. These will be increasingly important as organizations adopt technologies like post-quantum cryptography.

Reference page 2 of the new infographic for a matrix that shows detailed responsibilities for each model.

Now, let’s dig deeper into three models security teams commonly debate: PMK, BYOK/CMK, and HYOK.

 

Provider-Managed Keys (PMKs): Simplicity with Tradeoffs

With PMKs, the CSP generates all keys, manages the key lifecycle, and stores keys in their own infrastructure. The customer’s role is minimal: they configure encryption settings and may view basic reports.

Pros of PMKs:

• Easiest to adopt
• No need to run your own HSMs or KMS
• Good fit for low-risk data or environments where CSP compliance attestation is sufficient

Cons of PMKs:

• The CSP has potential access to keys and thus can decrypt data, subject to their internal controls
• Some regulatory or contractual requirements explicitly expect customer ownership of keys, especially for highly sensitive or sovereign workloads

 

Bring Your Own Key (BYOK) and Customer-Managed Keys (CMKs): More Control, Shared Responsibility

The CMK model is where the customer directs the lifecycle of keys that live inside the CSP’s KMS/HSM. By default, these CMKs are non-exportable to limit customer responsibility and prevent abuse.

BYOK is a specific variant of CMK in which the customer generates keys externally. Then, they securely import keys into the CSP environment and remain responsible for their copy of the key.

In a typical BYOK/CMK setup, the CSP manages key infrastructure (HSMs, KMS APIs) and basic operations. The customer configures policies, controls key usage, and directs rotation. Backup, retention, and some other aspects of the lifecycle are shared responsibilities.

Pros of BYOK:

• Stronger alignment with requirements that call for “customer-managed keys” or explicit control over key rotation and deletion
• Better separation of duties: application teams may use keys without being able to directly manage them
• Improved incident response (the customer can instruct the CSP to revoke or rotate keys quickly if they suspect compromise)

Cons of BYOK:

• Does not mean the CSP cannot access your data—as long as you use keys within the CSP’s KMS/HSM, the CSP can decrypt data

 

Hold Your Own Key (HYOK): Maximum Control, Maximum Responsibility

HYOK is an architecture where customers maintain control of keys within their own KMS solutions. The customer-managed KMS handles encryption key operations and requests. The customer retains control over the keys, even when they store their data in a CSP's environment. The CSP has no involvement in key generation and no access to keys.

Pros of HYOK:

• High assurance that your CSP cannot decrypt certain data
• Fulfills legal or contractual requirements that demand keys stay under direct customer control
• Best for multi-cloud or SaaS environments where you want a single, central KMS that all providers must talk to

Cons of HYOK:

• The overhead of running and securing your own KMS/HSM infrastructure
• Latency and availability challenges when cloud services depend on on-premises key operations
• The need for strong internal processes around backup, disaster recovery, and audit

 

In Conclusion

Here are some practical questions to drive the key responsibility model conversation:

• What are our regulatory drivers? Do we have requirements referencing FIPS 140-3-validated modules, NIST SP 800-57, ISO/IEC 27001, PCI DSS, or HIPAA? Do any of these explicitly mention customer control of encryption keys or key management policies?
• What are our privacy and sovereignty expectations? Is it acceptable for the CSP to have potential access to our keys (PMK, most CMK deployments)? For specific datasets, do we require a model where the provider cannot technically decrypt data?
• What’s our operational tolerance? Do we have the capability to run and secure HSMs and KMS infrastructure if we move toward HYOK? Can we integrate on-premises key systems with cloud services without creating reliability bottlenecks?
• How will future cryptography changes affect us?

Using CSA's infographic as a shared reference helps architects, compliance teams, and business stakeholders align on these questions. Start designing the right mix of PMK, BYOK/CMK, HYOK, and hybrid approaches for your organization today.